Self-hostedDNS hostingCapabilities verified
PowerDNS Authoritative
Migrate DNS zones to or from PowerDNS Authoritative: what's supported, what access you need, and what changes for each destination.
See how a domain's records would land at PowerDNS. Free and read-only.
Access we need
- Credentials
- API URL + API key (X-API-Key) + server ID
- Permissions
- The PowerDNS API key grants full read/write access to every zone on the server; there is no read-only key. Restrict it with webserver-allow-from.
Runs on your own infrastructure.
We connect to its API over the internet, so the API endpoint must be reachable on a public address over HTTPS. We never connect to private or internal addresses.
What PowerDNS supports
The same data the translation engine uses when it plans a migration.
- Create zones through the API
- List zones through the API
- Turn on DNSSEC through the API
- Apex CNAME (flattening)
- Apex ALIAS record
- Aliases to cloud resources
- CDN proxy on records
- Routing policies
- Minimum TTL
- auto
Record types
- A
- AAAA
- CNAME
- MX
- TXT
- NS
- SRV
- CAA
- PTR
- DS
- HTTPS
- SVCB
- TLSA
- SSHFP
- NAPTR
- SPF
- CERT
- URI
- DHCID
- DNAME
- OPENPGPKEY
- SMIMEA
- RP
- ALIAS
PowerDNS-only records
- LUA
These have no equivalent elsewhere and are flagged in every preview.
Good to know
- We only connect to public HTTPS addresses: expose the PowerDNS webserver through a reverse proxy with TLS and allow-list our egress IPs; private or internal addresses are refused.
- ALIAS records only resolve if expand-alias and a resolver are configured on the server, and DNAME needs dname-processing.
- Disabled records are not imported, and an RRset we update is replaced as a whole, so disabled entries inside it are dropped.